CVE-2020-1615 | CRITICAL | 9.8 | 0.01731 | 39.81 | No | No | 2020-04-08 | 2024-09-16 | euvd | The factory configuration for vMX installations, as shipped, includes default credentials for the root account. Without proper modification …The factory configuration for vMX installations, as shipped, includes default credentials for the root account. Without proper modification of these default credentials by the administrator, an attacker could exploit these credentials and access the vMX instance without authorization. This issue affects Juniper Networks Junos OS: 17.1 versions prior to 17.1R2-S11, 17.1R3-S2 on vMX; 17.2 versions prior to 17.2R3-S3 on vMX; 17.3 versions prior to 17.3R2-S5, 17.3R3-S7 on vMX; 17.4 versions prior to 17.4R2-S9, 17.4R3 on vMX; 18.1 versions prior to 18.1R3-S9 on vMX; 18.2 versions prior to 18.2R2-S7, 18.2R3-S3 on vMX; 18.2X75 versions prior to 18.2X75-D420, 18.2X75-D60 on vMX; 18.3 versions prior to 18.3R1-S7, 18.3R2-S3, 18.3R3-S1 on vMX; 18.4 versions prior to 18.4R1-S5, 18.4R2-S3, 18.4R3 on vMX; 19.1 versions prior to 19.1R1-S4, 19.1R2, 19.1R3 on vMX; 19.2 versions prior to 19.2R1-S3, 19.2R2 on vMX; 19.3 versions prior to 19.3R1-S1, 19.3R2 on vMX. |
CVE-2024-24325 | CRITICAL | 9.8 | 0.0173 | 39.81 | No | No | 2024-01-30 | 2025-06-20 | euvd | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParen…TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function. |
CVE-2023-51421 | CRITICAL | 9.9 | 0.00594 | 39.81 | No | No | 2023-12-29 | 2026-04-28 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D …Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2. |
CVE-2023-51417 | CRITICAL | 9.9 | 0.00606 | 39.81 | No | No | 2023-12-29 | 2026-04-28 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gut…Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3. |
CVE-2025-34515 | CRITICAL | 9.3 | 0.07449 | 39.81 | No | No | 2025-10-16 | 2026-05-15 | euvd | Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh tha…Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. |
CVE-2021-36471 | CRITICAL | 9.8 | 0.0174 | 39.81 | No | No | 2023-02-07 | 2025-04-23 | euvd | Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /…Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /admin/index2.html, /admin/index3.html URIs. Note: AdminLTE developers dispute that this a weakness with AdminLTE and is instead a misconfiguration error on various websites by the website developers. |
CVE-2026-7374 | CRITICAL | 9.9 | 0.00596 | 39.81 | No | Yes | 2026-05-26 | 2026-08-16 | euvd, nvd, packetstorm | A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a …A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster. |
CVE-2025-8324 | CRITICAL | 9.8 | 0.01745 | 39.81 | No | No | 2025-11-11 | 2026-02-26 | euvd | Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter conf…Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration. |
CVE-2023-25143 | CRITICAL | 9.8 | 0.01742 | 39.81 | No | No | 2023-03-07 | 2025-03-05 | euvd | An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote c…An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state on affected products. |
CVE-2025-20051 | CRITICAL | 9.9 | 0.00589 | 39.81 | No | No | 2025-02-24 | 2025-02-24 | euvd | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and…Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards. |
CVE-2023-22748 | CRITICAL | 9.8 | 0.0174 | 39.81 | No | No | 2023-02-28 | 2025-03-07 | euvd | There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p…There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2023-27746 | CRITICAL | 9.8 | 0.01752 | 39.81 | No | No | 2023-04-13 | 2025-02-07 | euvd | BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force …BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 handshake is intercepted. |
CVE-2022-37602 | CRITICAL | 9.8 | 0.01733 | 39.81 | No | No | 2022-10-14 | 2025-05-15 | euvd | Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js. |
CVE-2024-1015 | CRITICAL | 9.8 | 0.01737 | 39.81 | No | No | 2024-01-29 | 2026-07-20 | euvd | Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send differe…Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from the operating system to the system via the web configuration functionality of the device. |
CVE-2023-51410 | CRITICAL | 9.9 | 0.00606 | 39.81 | No | No | 2023-12-29 | 2026-04-28 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2.Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2. |
CVE-2024-34762 | CRITICAL | 9.9 | 0.0059 | 39.81 | No | No | 2024-06-10 | 2026-04-28 | euvd | Vulnerability discovered by executing a planned security audit.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversa…Vulnerability discovered by executing a planned security audit.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10. |
CVE-2023-29974 | CRITICAL | 9.8 | 0.01753 | 39.81 | No | No | 2023-11-08 | 2024-09-04 | euvd | An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements. |
CVE-2023-22747 | CRITICAL | 9.8 | 0.0174 | 39.81 | No | No | 2023-02-28 | 2025-03-11 | euvd | There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p…There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2025-42887 | CRITICAL | 9.9 | 0.00597 | 39.81 | No | No | 2025-11-11 | 2025-11-12 | euvd | Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enable…Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system. |
CVE-2023-27068 | CRITICAL | 9.8 | 0.01742 | 39.81 | No | No | 2023-05-23 | 2025-01-28 | euvd | Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationR…Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx. |
CVE-2024-21812 | CRITICAL | 9.8 | 0.01757 | 39.81 | No | No | 2024-02-20 | 2025-11-04 | euvd | An integer overflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0e…An integer overflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to an out-of-bounds write which in turn can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. |
CVE-2023-40400 | CRITICAL | 9.8 | 0.0175 | 39.81 | No | No | 2023-09-26 | 2025-11-04 | euvd | This issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. A remote u…This issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. A remote user may cause an unexpected app termination or arbitrary code execution. |
CVE-2006-7105 | CRITICAL | 9.8 | 0.01735 | 39.81 | No | No | 2007-03-03 | 2025-01-17 | euvd | PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via a…PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter. NOTE: in the original disclosure, filename is used in a function definition, so this report is probably incorrect |
CVE-2024-24594 | CRITICAL | 9.9 | 0.00594 | 39.81 | No | No | 2024-02-06 | 2024-08-01 | euvd | A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote atta…A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a JavaScript payload when a user views the Debug Samples tab in the web UI. |
CVE-2024-24332 | CRITICAL | 9.8 | 0.0173 | 39.81 | No | No | 2024-01-30 | 2025-05-30 | euvd | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilte…TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function. |
CVE-2022-33175 | CRITICAL | 9.8 | 0.01733 | 39.81 | No | No | 2022-06-13 | 2024-08-03 | euvd | Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.toke…Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. The session id can then be reused to act as the administrator, allowing reading of the cleartext password, or reconfiguring the device. |
CVE-2022-36436 | CRITICAL | 9.8 | 0.01715 | 39.8 | No | No | 2022-09-14 | 2024-08-03 | euvd | OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerab…OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could allow a malicious actor to gain unauthorized access to a VNC session or to disconnect a legitimate user from a VNC session. A remote attacker with network access to the proxy server could leverage this vulnerability to connect to VNC servers protected by the proxy server without providing any authentication credentials. Exploitation of this issue requires that the proxy server is currently accepting connections for the target VNC server. |
CVE-2023-24479 | CRITICAL | 9.8 | 0.01711 | 39.8 | No | No | 2023-10-11 | 2024-08-02 | euvd | An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network…An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability. |
CVE-2021-41691 | CRITICAL | 9.8 | 0.01723 | 39.8 | No | No | 2025-06-24 | 2025-06-25 | euvd | A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" para…A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to /TransferredOutModal.php. |
CVE-2020-36718 | CRITICAL | 9.8 | 0.01719 | 39.8 | No | No | 2023-06-07 | 2026-04-08 | euvd | The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deseri…The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrusted input "njt_gdpr_allow_permissions" value. This allows unauthenticated attackers to inject a PHP Object. |
CVE-2024-23619 | CRITICAL | 9.8 | 0.01712 | 39.8 | No | No | 2024-01-25 | 2025-06-16 | euvd | A hardcoded credential vulnerability exists in IBM Merge Healthcare eFilm Workstation. A remote, unauthenticated attacker can exploit this v…A hardcoded credential vulnerability exists in IBM Merge Healthcare eFilm Workstation. A remote, unauthenticated attacker can exploit this vulnerability to achieve information disclosure or remote code execution. |
CVE-2023-46149 | CRITICAL | 9.9 | 0.00584 | 39.8 | No | No | 2023-12-20 | 2026-04-28 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.…Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5. |
CVE-2025-62878 | CRITICAL | 9.9 | 0.00581 | 39.8 | No | Yes | 2026-02-25 | 2026-02-26 | euvd, packetstorm | A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially …A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories. |
CVE-2021-31349 | CRITICAL | 9.8 | 0.01721 | 39.8 | No | No | 2021-10-19 | 2024-09-16 | euvd | The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, …The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to 4.5.11, and all versions of 5.0 up to and including 5.0.1. |
CVE-2026-9559 | CRITICAL | 9.9 | 0.00583 | 39.8 | No | No | 2026-05-29 | 2026-05-29 | euvd, nvd | A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports…A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges (campaign:imports:create) can write arbitrary PHP files to sensitive system directories. An attacker can exploit this to overwrite critical internal configuration or cache components, resulting in Remote Code Execution (RCE) under the context of the web server user. |
CVE-2026-9558 | CRITICAL | 9.9 | 0.00571 | 39.8 | No | Yes | 2026-05-29 | 2026-05-29 | euvd, nvd, packetstorm | A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without …A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings. |
CVE-2024-23061 | CRITICAL | 9.8 | 0.01728 | 39.8 | No | No | 2024-01-11 | 2025-06-20 | euvd | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setSched…TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setScheduleCfg function. |
CVE-2026-34048 | CRITICAL | 9.9 | 0.00576 | 39.8 | No | No | 2026-07-07 | 2026-07-07 | euvd | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websoc…Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing a low-privileged team member to connect to terminal routes and execute commands on team servers. This issue is fixed in version 4.0.0-beta.471. |
CVE-2023-5746 | CRITICAL | 9.8 | 0.01701 | 39.8 | No | No | 2023-10-24 | 2024-09-12 | euvd | A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute …A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 may be affected: BC500 and TC500. |
CVE-2022-2437 | CRITICAL | 9.8 | 0.0171 | 39.8 | No | No | 2022-07-18 | 2026-04-08 | euvd | The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the '…The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter in versions up to, and including 2.9.8.5. This makes it possible for unauthenticated attackers to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. |
CVE-2023-36911 | CRITICAL | 9.8 | 0.01705 | 39.8 | No | No | 2023-08-08 | 2026-08-10 | euvd, nvd | Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityMicrosoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2021-43445 | CRITICAL | 9.8 | 0.01707 | 39.8 | No | No | 2023-01-23 | 2025-04-02 | euvd | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service o…ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key. |
CVE-2020-36837 | CRITICAL | 9.9 | 0.00584 | 39.8 | No | No | 2024-10-16 | 2024-10-16 | euvd | The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wiza…The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wizard_actions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there is a user named 'admin', the attacker will become automatically logged in as an administrator. |
CVE-2026-42196 | CRITICAL | 9.9 | 0.00565 | 39.8 | No | No | 2026-05-12 | 2026-05-13 | euvd | django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path t…django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2. |
CVE-2024-31666 | CRITICAL | 9.8 | 0.01711 | 39.8 | No | No | 2024-04-22 | 2025-03-26 | euvd | An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit_addon_post.php component.An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit_addon_post.php component. |
CVE-2024-37424 | CRITICAL | 9.9 | 0.00566 | 39.8 | No | No | 2024-07-09 | 2026-04-28 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This i…Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspack Blocks: from n/a through 3.0.8. |
CVE-2022-1357 | CRITICAL | 9.8 | 0.01713 | 39.8 | No | No | 2022-05-17 | 2025-04-16 | euvd | The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privil…The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web server. This lack of validation could allow an attacker to append arbitrary data to the logger command. |
CVE-2024-51115 | CRITICAL | 9.8 | 0.01727 | 39.8 | No | No | 2024-11-05 | 2024-11-06 | euvd | DCME-320 v7.4.12.90 was discovered to contain a command injection vulnerability.DCME-320 v7.4.12.90 was discovered to contain a command injection vulnerability. |
CVE-2026-24105 | CRITICAL | 9.8 | 0.01704 | 39.8 | No | No | 2026-03-02 | 2026-03-03 | euvd | An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially lead…An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd. |
CVE-2023-29130 | CRITICAL | 9.9 | 0.00564 | 39.8 | No | No | 2023-07-11 | 2024-11-12 | euvd | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of improper access controls in the co…A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of improper access controls in the configuration files that leads to privilege escalation. An attacker could gain admin access with this vulnerability leading to complete device control. |